CVE-2026-10090

{"id": "CVE-2026-10090", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10090", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T13:49:40.960456Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:acm:2.11::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.11", "versions": [{"status": "unaffected", "version": "1787263584", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.13::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.13", "versions": [{"status": "unaffected", "version": "1787263693", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.14::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14", "versions": [{"status": "unaffected", "version": "1787170830", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.15::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15", "versions": [{"status": "unaffected", "version": "1787240030", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.16::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16", "versions": [{"status": "unaffected", "version": "1787242321", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:acm:2.17::el9"], "vendor": "Red Hat", "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17", "versions": [{"status": "unaffected", "version": "1787242108", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhacm2/multicluster-operators-subscription-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}]}], "published": "2026-08-05T09:18:14.667", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:60386", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60387", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60388", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60389", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60390", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60391", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-10090", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483292", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-267"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM). A user with namespace-scoped \"edit\" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they control and a Subscription resource referencing it. The app-subscription controller fetches and applies the Helm chart contents with its own elevated authority, without verifying whether the subscription creator holds the \"open-cluster-management:subscription-admin\" role and without restricting applied resources to the subscription namespace. This allows the attacker to include cluster-scoped resources in the Helm chart, such as a ClusterRoleBinding granting the attacker's ServiceAccount the \"cluster-admin\" ClusterRole. Successful exploitation results in full cluster-admin privilege escalation. This contradicts the ACM documentation which states that non-subscription-admin users should have resources deployed into the subscription namespace only."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en el controlador de suscripciones de aplicaciones (multicluster-operators-subscription) de Red Hat Advanced Cluster Management for Kubernetes (ACM). Un usuario con privilegios de \u2019edici\u00f3n\u2019 con \u00e1mbito de espacio de nombres en un espacio de nombres de hub de ACM puede crear un recurso Channel que apunta a un repositorio Helm que controla y un recurso Subscription que lo referencia. El controlador app-subscription obtiene y aplica el contenido del gr\u00e1fico Helm con su propia autoridad elevada, sin verificar si el creador de la suscripci\u00f3n posee el rol \u2019open-cluster-management:subscription-admin\u2019 y sin restringir los recursos aplicados al espacio de nombres de la suscripci\u00f3n. Esto permite al atacante incluir recursos con \u00e1mbito de cl\u00faster en el gr\u00e1fico Helm, como un ClusterRoleBinding que otorga a la ServiceAccount del atacante el ClusterRole \u2019cluster-admin\u2019. La explotaci\u00f3n exitosa resulta en una escalada de privilegios completa de cluster-admin. Esto contradice la documentaci\u00f3n de ACM que establece que los usuarios no-subscription-admin solo deben tener recursos desplegados en el espacio de nombres de la suscripci\u00f3n."}], "lastModified": "2026-10-23T21:10:00.157", "sourceIdentifier": "secalert@redhat.com"}